Data Processing Addendum

Status of this addendum

This published addendum describes how Apexward Technology Ltd processes personal data as a processor for CyberEssentials.AI services. A signed DPA is available on request for Enterprise or procurement reviews. Counsel may issue replacement text; until then this page is the public reference.

1. Parties and roles

Processor: Apexward Technology Ltd, part of Apexward Group, of Apexward Technology Ltd, Basepoint Business Centre, Caxton Close, Andover, Hampshire, SP10 3FG.

Controller: the organisation that instructs us to process personal data in connection with a Cyber Essentials assessment, portal account, quote, booking or support request.

For website analytics we act as a controller. See the Privacy Policy.

2. Subject matter and duration

We process personal data to deliver certification services, operate the customer portal, calculate quotes, send transactional mail, provide live chat and support, and host related records. Processing lasts for the life of the relevant account or enquiry, then for the retention periods in the Privacy Policy.

3. Types of personal data

• Identity and contact data: name, role, organisation, email, telephone.
• Account and technical data: login identifiers, IP address, device and browser data.
• Assessment and support content you submit, including evidence files you upload.
• Booking and chat transcripts where you use those channels.

4. Instructions and confidentiality

We process personal data only on documented instructions, including this addendum, your order, and applicable UK law. Staff with access are bound by confidentiality. We will tell you if we believe an instruction breaches UK GDPR, unless the law forbids that notice.

5. Subprocessors

You authorise us to use the subprocessors listed on the subprocessors page. We will keep that list dated. If you object to a new subprocessor on reasonable data-protection grounds, contact hello@apexward.com before the change takes effect where we have given notice, or as soon as practicable after publication of an urgent security change.

6. Security

We apply appropriate technical and organisational measures, including encryption in transit, access control, and hosting on Cloudflare infrastructure. Details of how the assessment portal is secured are available from Apexward Group on request.

7. International transfers

We store personal data in the United Kingdom or the European Economic Area where we can. Where a transfer outside that area is required, we use the UK Addendum to the EU Standard Contractual Clauses or another lawful safeguard.

8. Assistance, deletion and audit

We will assist with data-subject requests, DPIAs and breach notification to the extent the information is available to us. After the services end we will delete or return personal data, except where UK law requires retention. Reasonable audit information is available on request; on-site audits are by agreement.

9. Contact

Data protection questions: hello@apexward.com. Post: Data Protection Officer, Apexward Technology Ltd, Basepoint Business Centre, Caxton Close, Andover, Hampshire, SP10 3FG.